Privacy Act of 1974; System of Records, 43386-43391 [2011-18315]

Agencies

• DEPARTMENT OF VETERANS AFFAIRS

[Federal Register Volume 76, Number 139 (Wednesday, July 20, 2011)]
[Notices]
[Pages 43386-43391]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 2011-18315]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF VETERANS AFFAIRS


Privacy Act of 1974; System of Records

AGENCY: Department of Veterans Affairs (VA).

ACTION: Notice of establishment of new system of records.

-----------------------------------------------------------------------

SUMMARY: The Privacy Act of 1974 (5 U.S.C. 552(e)(4)) requires that all 
agencies publish in the Federal Register a notice of the existence and 
character of their systems of records. Notice is hereby given that the 
Department of Veterans Affairs (VA) is establishing a new system of 
records entitled ``Ethics Consultation Web-based Database (ECWeb)-VA'' 
(152VA10E).

DATES: Comments on this new system of records must be received no later 
than August 19, 2011. If no public comment is received, the new system 
will become effective August 19, 2011.

ADDRESSES: Written comments may be submitted through https://www.Regulations.gov; by mail or hand-delivery to the Director, 
Regulations Management (02REG), Department of Veterans Affairs, 810 
Vermont Ave., NW., Room 1068, Washington, DC 20420; or by fax to (202) 
273-9026. Copies of comments received will be available for public 
inspection in the Office of Regulation Policy and Management, Room 
1063B, between the hours of 8 a.m. and 4:30 p.m. Monday through Friday 
(except holidays). Please call (202) 461-4902 for an appointment. In 
addition, during the comment period, comments may be viewed online 
through the Federal Docket Management System (FDMS).

FOR FURTHER INFORMATION CONTACT: Kenneth Berkowitz, MD, Chief, Ethics 
Consultation, National Center for Ethics in Health Care (10E), 
Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, DC 
20420; telephone (202) 501-0364.

SUPPLEMENTARY INFORMATION:

I. Description of Proposed Systems of Records

    Designed by the National Center for Ethics in Health Care (Ethics 
Center), ECWeb is a Web-based database tool that reinforces sound 
ethics consultation practices and provides a consistent electronic 
method for documenting, storing, retrieving and evaluating ethics 
consultation data. It is part of the Ethics Center's overall efforts to 
improve the quality of ethics practice throughout VHA.
    Specific data related to an ethics consultation are entered into 
designed fields in each consultation record. A note summarizing the 
ethics consultation may be generated and added to the patient's health 
record. Additionally, data is stored, retrieved, and analyzed to 
improve ethics consultation practices and the quality of care to 
Veteran patients.
    Categories of individuals covered by the system:
    1. Veterans who have applied for health care services under Title 
38, U.S.C., Chapter 17, and members of their immediate families.
    2. Spouse, surviving spouse, and children of Veterans who have 
applied for health care services under Title 38, U.S.C., Chapter 17.
    3. Individuals who the Veteran has included in health care 
planning, e.g., legally appointed Durable Power of Attorney for Health 
Care or other authorized surrogate under VHA Handbook 1004.01.
    4. Individuals examined or treated under contract or resource 
sharing agreements.
    5. Individuals examined or treated for research or donor purposes.
    6. Individuals who have applied for Title 38 benefits but who do 
not meet the requirements under Title 38 to receive such benefits.
    7. Individuals who were provided medical care under emergency 
conditions for humanitarian reasons.
    8. Pensioned members of allied forces provided health care services 
under Title 38, U.S.C., Chapter I.
    9. Current and former employees.
    10. Contractors employed by VA.

II. Proposed Routine Use Disclosures of Data in the System

    We are proposing to establish the following Routine Use disclosures 
of information maintained in the system. To the extent that records 
contained in the system include information protected by 45 CFR Parts 
160 and 164, i.e., individually identifiable health information, and 38 
U.S.C. 7332, i.e., medical treatment information related to drug abuse, 
alcoholism or alcohol abuse, sickle cell anemia or infection with the 
human immunodeficiency virus, that information cannot be disclosed 
under a routine use unless there is also specific statutory authority 
in 38 U.S.C. 7332 and regulatory authority in 45 CFR Parts 160 and 164 
permitting disclosure.
    1. Disclosure of health care information as deemed necessary and 
proper to Federal, state and local government agencies and national 
health organizations in order to assist in the development of programs 
that will be beneficial to claimants, to protect their rights under 
law, and assure that they are receiving all benefits to which they are 
entitled.
    2. Disclosure of health care information furnished and the period 
of care, as deemed necessary and proper, to accredited service 
organization representatives and other approved agents, attorneys, and 
insurance companies to aid claimants whom they represent in the 
preparation, presentation and prosecution of claims under laws 
administered by VA, state or local agencies.
    3. VA may disclose on its own initiative any information in this 
system, except the names and home addresses of Veterans and their 
dependents, which is relevant to a suspected or reasonably imminent 
violation of law, whether civil, criminal or regulatory in nature, and 
whether arising by general or program statute or by regulation, rule or 
order issued pursuant thereto, to a Federal, state, local, tribal, or 
foreign agency charged with the responsibility of investigating or 
prosecuting such violation, or charged with enforcing or implementing 
the statute, regulation, rule or order. On its own initiative, VA may 
also disclose the names and addresses of Veterans and their dependents 
to a Federal agency charged with the responsibility of investigating or 
prosecuting civil, criminal or regulatory violations of law, or charged 
with enforcing or implementing the statute, regulation, rule or order 
issued pursuant thereto.
    4. Disclosure of individually-identifiable health care information 
may be made by appropriate VA personnel to the extent necessary and on 
a need-to-know basis, consistent with good medical and ethical 
practices, to family members and/or the person(s) with whom the patient 
has a meaningful relationship.
    5. Relevant information may be disclosed in the course of 
presenting evidence to a court, magistrate or administrative tribunal, 
in matters of guardianship, inquests and

[[Page 43387]]

commitments; to private attorneys representing Veterans rated 
incompetent in conjunction with issuance of Certificates of 
Incompetency; and to probation and parole officers in connection with 
Court required duties.
    6. Relevant information may be disclosed to a guardian ad litem in 
relation to his or her representation of a claimant in any legal 
proceeding.
    7. Any relevant information may be disclosed to attorneys, 
insurance companies, employers, third parties liable or potentially 
liable under health plan contracts, and to courts, boards, or 
commissions, only to the extent necessary to aid VA in preparation, 
presentation, and prosecution of claims authorized under Federal, 
state, or local laws, and regulations promulgated thereunder.
    8. Disclosure of health information, excluding name and home 
address, (unless name and address is furnished by the requester) for 
research purposes determined to be necessary and proper, to 
epidemiological and other research entities approved by the Under 
Secretary for Health.
    9. In order to conduct Federal research necessary to accomplish a 
statutory purpose of an agency, at the written request of the head of 
the agency, or designee of the head of that agency, the name(s) and 
address(es) of present or former personnel of the Armed Services and/or 
their dependents may be disclosed (a) to a Federal department or agency 
or (b) directly to a contractor of a Federal department or agency. When 
a disclosure of this information is to be made directly to the 
contractor, VA may impose applicable conditions on the Department, 
agency and/or contractor to ensure the appropriateness of the 
disclosure to the contractor.
    10. Relevant information may be disclosed to the Department of 
Justice and United States Attorneys in defense or prosecution of 
litigation involving the United States, and to Federal agencies upon 
their request in connection with review of administrative tort claims 
filed under the Federal Tort Claims Act, 28 U.S.C. 2672.
    11. Health care information concerning a non-judicially declared 
incompetent patient may be disclosed to a third party upon the written 
authorization of the patient's next of kin in order for the patient or, 
consistent with the best interest of the patient, a member of the 
patient's family, to receive a benefit to which the patient or family 
member is entitled or, to arrange for the patient's discharge from a VA 
medical facility. Sufficient information to make an informed 
determination will be made available to such next-of-kin. If the 
patient's next-of-kin are not reasonably accessible, the Chief of 
Staff, Director, or designee of the custodial VA medical facility may 
make disclosure of health care information for these purposes.
    12. Relevant health care information may be disclosed to a non-VA 
nursing home facility that is considering the patient for admission, 
when information concerning the individual's medical care is needed for 
the purpose of preadmission screening under 42 CFR 483.20(f), for the 
purpose of identifying patients who are mentally ill or mentally 
retarded, so they can be evaluated for appropriate placement.
    13. Relevant health care information may be disclosed to a State 
Veterans Home for the purpose of medical treatment and/or follow-up at 
the State Home when VA makes payment of a per diem rate to the State 
Home for the patient receiving care at such home, and the patient 
receives VA medical care.
    14. Relevant health care information may be disclosed to (a) A 
Federal agency or non-VA health care provider or institution when VA 
refers a patient for hospital or nursing home care or medical services, 
or authorizes a patient to obtain non-VA medical services and the 
information is needed by the Federal agency or non-VA institution or 
provider to perform the services; or (b) a Federal agency or a non-VA 
hospital (Federal, state and local, public or private) or other medical 
installation having hospital facilities, blood banks, or similar 
institutions, medical schools or clinics, or other groups or 
individuals that have contracted or agreed to provide medical services, 
or share the use of medical resources under the provisions of 38 U.S.C. 
513, 7409, 8111, or 8153, when treatment is rendered by VA under the 
terms of such contract or agreement or the issuance of an 
authorization, and the information is needed for purposes of medical 
treatment and/or follow-up determining entitlement to a benefit or, for 
VA to effect recovery of the costs of the medical care.
    15. For program review purposes and the seeking of accreditation 
and/or certification, health care information may be disclosed to 
survey teams of The Joint Commission (TJC), and similar national 
accrediting agencies or boards with whom VA has a contract or agreement 
to conduct such reviews, but only to the extent that the information is 
necessary and relevant to the review.
    16. Information from a named patient's VA medical record which 
relates to the performance of a health care student or provider may be 
disclosed to a medical or nursing school, or other health care related 
training institution, or other facility with which there is an 
affiliation, sharing agreement, contract, or similar arrangement when 
the student or provider is enrolled at or employed by the school or 
training institution, or other facility, and the information is needed 
for personnel management, rating and/or evaluation purposes.
    17. Relevant health care information may be disclosed to 
individuals, organizations, private or public agencies, etc., with whom 
VA has a contract or sharing agreement for the provision of health care 
or administrative services.
    18. Patient identifying information may be disclosed to Federal 
agencies and VA and government-wide third-party insurers responsible 
for payment of the cost of medical care for the identified patients, in 
order for VA to seek recovery of the medical care costs. These records 
may also be disclosed as part of a computer matching program to 
accomplish these purposes.
    19. Relevant health care information may be disclosed to health and 
welfare agencies, housing resources and utility companies, possibly to 
be combined with disclosures to other agencies in situations where VA 
needs to act quickly in order to provide basic and/or emergency needs 
for the Veteran and Veteran's family where the family resides with the 
Veteran or serves as a caregiver.
    20. The record of an individual who is covered by a system of 
records may be disclosed to a Member of Congress, or a staff person 
acting for the Member, when the Member or staff person requests the 
record on behalf of and at the written request of the individual.
    21. Disclosure may be made to the National Archives and Records 
Administration in records management inspections conducted under 
authority of Title 44 U.S.C.
    22. VA may disclose information from this system of records to the 
Department of Justice (DoJ), either on VA's initiative or in response 
to DoJ's request for the information, after either VA or DoJ determines 
that such information is relevant to DoJ's representation of the United 
States or any of its components in legal proceedings before a court or 
adjudicative body, provided that, in each case, the agency also 
determines prior to disclosure that release of the records to the DoJ 
is a use of the information contained in the records that is compatible 
with the purpose for which VA collected records. VA, on its own 
initiative, may disclose records in this system of records in legal

[[Page 43388]]

proceedings before a court or administrative body after determining 
that the disclosure of the records to the court or administrative body 
is a use of the information contained in the records that is compatible 
with the purpose for which VA collected the records.
    23. Disclosure of relevant information may be made to individuals, 
organizations, private or public agencies, or other entities with whom 
VA has a contract or agreement or where there is a subcontract to 
perform such services as VA may deem practicable for the purposes of 
laws administered by VA, in order for the contractor or subcontractor 
to perform the services of the contract or agreement.
    24. VA may disclose on its own initiative any information in the 
system, except the names and home addresses of Veterans and their 
dependents, that is relevant to a suspected or reasonably imminent 
violation of the law whether civil, criminal, or regulatory in nature 
and whether arising by general or program statue or by regulation, rule 
or order issued pursuant thereto, to a Federal, state, local, tribal or 
foreign agency charged with the responsibility of investigation or 
prosecuting such violation, or charged with enforcing or implementing 
the statute, regulation, rule or order. VA may also disclose on its own 
initiative the names and addresses of Veterans and their dependents to 
a Federal agency charged with the responsibility of investigating or 
prosecuting civil, criminal, or regulatory violations of law, or 
charged with enforcing or implementing the statutes, regulation, or 
order issued pursuant thereto.
    25. Disclosure to other Federal agencies may be made to assist such 
agencies in preventing and detecting possible fraud or abuse by 
individuals in their operations and programs.
    26. VA may, on its own initiative, disclose any information or 
records to appropriate agencies, entities, and persons when (1) VA 
suspects or has confirmed that the integrity or confidentiality of 
information in the system of records has been compromised; (2) the 
Department has determined that as a result of the suspected or 
confirmed compromise, there is a risk of embarrassment or harm to the 
reputations of the record subject, harm to economic or property 
interests, identify theft or fraud, or harm to the security, 
confidentiality, or integrity of this system or other systems (entity) 
that rely upon the potentially compromised information; and (3) the 
disclosure is to agencies, entities, or persons whom VA determines as 
reasonably necessary to assist or carry out the Department's efforts to 
respond to the suspected or confirmed compromise and prevent, minimize, 
or remedy such harm. This routine uses permits disclosures by the 
Department to respond to a suspect or confirmed data breach, including 
the conduct of any risk analysis or provision of credit protection 
services as provided in 38 U.S.C. 5724, as the terms are defined in 38 
U.S.C. 5727.
    27. For program review purposes and the seeking of accreditation 
and/or certification, disclosure may be made to survey teams of TJC and 
similar national accreditation agencies or boards with whom VA has a 
contract or agreement to conduct such reviews, but only to the extent 
that the information is necessary and relevant to the review.
    28. Disclosure of information may be made to the next-of-kin and/or 
the person(s) with whom the patient has a meaningful relationship to 
the extent necessary and on a need-to-know basis consistent with good 
medical and ethical practices.
    29. Assist in quality improvement efforts with respect to ethics 
consultation practices as part of approved research or ongoing quality 
improvement projects.

III. Compatibility of the Proposed Routine Uses

    The Privacy Act permits VA to disclose information about 
individuals without their consent for a routine use when the 
information will be used for a purpose that is compatible with the 
purpose for which we collected the information. In all of the routine 
use disclosures described above, the recipient of the information will 
use the information in connection with a matter relating to one of VA's 
programs, will use the information to provide a benefit to VA, or 
disclosure is required by law.
    The notice of intent to publish and an advance copy of the system 
notice have been sent to the appropriate Congressional committees and 
to the Director of the Office of Management and Budget (OMB) as 
required by 5 U.S.C. 552a(r) (Privacy Act) and guidelines issued by OMB 
(65 FR 77677), December 12, 2000.

    Approved: June 28, 2011.
John R. Gingrich,
Chief of Staff, Department of Veterans Affairs.
152VA10E

SYSTEM NAME:
    Ethics Consultation Web-based Database (ECWeb)-VA.

SYSTEM LOCATION:
    Automated records within the Ethics Consultation Web-based Database 
(ECWeb) may be maintained on a VA-owned server administered by the 
Department of Veterans Affairs, 810 Vermont Avenue, NW., Washington, 
DC.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:
    The records include information concerning.
    1. Veterans who have applied for health care services under Title 
38, U.S.C., Chapter 17, and members of their immediate families.
    2. Spouse, surviving spouse, and children of Veterans who have 
applied for health care services under Title 38, U.S.C., Chapter 17.
    3. Beneficiaries of other Federal agencies.
    4. Individuals examined or treated under contract or resource 
sharing agreements.
    5. Individuals examined or treated for research or donor purposes.
    6. Individuals who have applied for Title 38 benefits, but who do 
not meet the requirements under Title 38 to receive such benefits.
    7. Individuals who were provided medical care under emergency 
conditions for humanitarian reasons.
    8. Pensioned members of allied forces provided health care services 
under Title 38, U.S.C., Chapter I.
    9. Current and former employees.
    10. Contractors employed by the Department of Veterans Affairs.

CATEGORIES OF RECORDS IN THE SYSTEM:
    The records may include information related to ethics consultations 
performed in and for VHA medical treatment facilities. Information may 
include relevant information from a medical record (a cumulative 
account of sociological, diagnostic, counseling, rehabilitation, drug 
and alcohol, dietetic, medical, surgical, dental, psychological, and/or 
psychiatric information compiled by VA professional staff and non-VA 
health care providers); subsidiary record information (e.g., tumor 
registry, dental, pharmacy, nuclear medicine, clinical laboratory, 
radiology, and patient scheduling information); identifying information 
(e.g., name, address, date of birth, partial social security number), 
military service information (e.g., dates, branch and character of 
service, service number, medical information), family or authorized 
surrogate information (e.g., next-of-kin and person to notify in an 
emergency), employment information (e.g., occupation, employer name and 
address), and information pertaining to the individual's medical, 
surgical, psychiatric, dental, and/or

[[Page 43389]]

psychological examination, evaluation, and/or treatment (e.g., 
information related to the chief complaint and history of present 
illness; information related to physical, diagnostic, therapeutic, 
special examinations, clinical laboratory, pathology and x-ray 
findings, operations, medical history, medications prescribed and 
dispensed, treatment plan and progress, consultations; photographs 
taken for identification and medical treatment; education and research 
purposes; facility locations where treatment is provided; observations 
and clinical impressions of health care providers to include identity 
of providers and to include, as appropriate, the present state of the 
patient's health, an assessment of the patient's emotional, behavioral, 
and social status, as well as an assessment of the patient's 
rehabilitation potential and nursing care needs). In addition the 
record may include the name and contact information for health care 
providers, and information regarding medical care rendered by those 
providers.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:
    Title 38, U.S.C., 501(b), 304, 7301, and 7304(a).

PURPOSE(S):
    The automated records may be used for such purposes as: Ethics 
consultation; ongoing treatment of the patient; documentation of 
treatment provided; payment; health care operations such as producing 
various management and patient follow-up reports; responding to patient 
and other inquiries; for epidemiological research and other health care 
related studies; statistical analysis, resource allocation and 
planning; providing clinical and administrative support to patient 
medical care; for audits, reviews and investigations conducted by staff 
of the health care facility, the networks, VA Central Office, and the 
VA Office of Inspector General (OIG); sharing of health information 
between and among Veterans Health Administration (VHA), Department of 
Defense (DoD), Indian Health Services (IHS), and other government and 
private industry health care organizations; law enforcement 
investigations; quality improvement/assurance audits, reviews and 
investigations; personnel management and evaluation; employee ratings 
and performance evaluations, and employee disciplinary or other adverse 
action, including discharge; advising health care professional 
licensing or monitoring bodies or similar entities of activities of VA 
and former VA health care personnel; and, accreditation of a facility 
by an entity such as TJC.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES 
OF USERS AND THE PURPOSES OF SUCH USES:
    To the extent that records contained in the system include 
information protected by 45 CFR Parts 160 and 164, i.e., individually 
identifiable health information, and 38 U.S.C. 7332, i.e., medical 
treatment information related to drug abuse, alcoholism or alcohol 
abuse, sickle cell anemia or infection with the human immunodeficiency 
virus, that information cannot be disclosed under a routine use unless 
there is also specific statutory authority in 38 U.S.C. 7332 and 
regulatory authority in 45 CFR Parts 160 and 164 permitting disclosure.
    1. Disclosure of health care information as deemed necessary and 
proper to Federal, state and local government agencies and national 
health organizations in order to assist in the development of programs 
that will be beneficial to claimants, to protect their rights under 
law, and assure that they are receiving all benefits to which they are 
entitled.
    2. Disclosure of health care information furnished and the period 
of care, as deemed necessary and proper, to accredited service 
organization representatives and other approved agents, attorneys, and 
insurance companies to aid claimants whom they represent in the 
preparation, presentation and prosecution of claims under laws 
administered by VA, state or local agencies.
    3. VA may disclose on its own initiative any information in this 
system, except the names and home addresses of Veterans and their 
dependents, which is relevant to a suspected or reasonably imminent 
violation of law, whether civil, criminal or regulatory in nature, and 
whether arising by general or program statute or by regulation, rule or 
order issued pursuant thereto, to a Federal, state, local, tribal, or 
foreign agency charged with the responsibility of investigating or 
prosecuting such violation, or charged with enforcing or implementing 
the statute, regulation, rule or order. On its own initiative, VA may 
also disclose the names and addresses of Veterans and their dependents 
to a Federal agency charged with the responsibility of investigating or 
prosecuting civil, criminal or regulatory violations of law, or charged 
with enforcing or implementing the statute, regulation, rule or order 
issued pursuant thereto.
    4. Disclosure of individually-identifiable health care information 
may be made by appropriate VA personnel to the extent necessary and on 
a need-to-know basis, consistent with good medical and ethical 
practices, to family members and/or the person(s) with whom the patient 
has a meaningful relationship.
    5. Relevant information may be disclosed in the course of 
presenting evidence to a court, magistrate or administrative tribunal, 
in matters of guardianship, inquests and commitments; to private 
attorneys representing Veterans rated incompetent in conjunction with 
issuance of Certificates of Incompetency; and to probation and parole 
officers in connection with Court required duties.
    6. Relevant information may be disclosed to a guardian ad litem in 
relation to his or her representation of a claimant in any legal 
proceeding.
    7. Any relevant information may be disclosed to attorneys, 
insurance companies, employers, third parties liable or potentially 
liable under health plan contracts, and to courts, boards, or 
commissions, only to the extent necessary to aid VA in preparation, 
presentation, and prosecution of claims authorized under Federal, 
state, or local laws, and regulations promulgated thereunder.
    8. Disclosure of health information, excluding name and home 
address, (unless name and address is furnished by the requester) for 
research purposes determined to be necessary and proper, to 
epidemiological and other research entities approved by the Under 
Secretary for Health.
    9. In order to conduct Federal research necessary to accomplish a 
statutory purpose of an agency, at the written request of the head of 
the agency, or designee of the head of that agency, the name(s) and 
address(es) of present or former personnel of the Armed Services and/or 
their dependents may be disclosed (a) To a Federal department or agency 
or (b) directly to a contractor of a Federal department or agency. When 
a disclosure of this information is to be made directly to the 
contractor, VA may impose applicable conditions on the department, 
agency and/or contractor to ensure the appropriateness of the 
disclosure to the contractor.
    10. Relevant information may be disclosed to the Department of 
Justice and United States Attorneys in defense or prosecution of 
litigation involving the United States, and to Federal agencies upon 
their request in connection with review of administrative tort claims 
filed under the Federal Tort Claims Act, 28 U.S.C. 2672.
    11. Health care information concerning a non-judicially declared

[[Page 43390]]

incompetent patient may be disclosed to a third party upon the written 
authorization of the patient's next of kin in order for the patient or, 
consistent with the best interest of the patient, a member of the 
patient's family, to receive a benefit to which the patient or family 
member is entitled or, to arrange for the patient's discharge from a VA 
medical facility. Sufficient information to make an informed 
determination will be made available to such next of kin. If the 
patient's next of kin are not reasonably accessible, the Chief of 
Staff, Director, or designee of the custodial VA medical facility may 
make disclosure of health care information for these purposes.
    12. Relevant health care information may be disclosed to a non-VA 
nursing home facility that is considering the patient for admission, 
when information concerning the individual's medical care is needed for 
the purpose of preadmission screening under 42 CFR 483.20(f), for the 
purpose of identifying patients who are mentally ill or mentally 
retarded, so they can be evaluated for appropriate placement.
    13. Relevant health care information may be disclosed to a State 
Veterans Home for the purpose of medical treatment and/or follow-up at 
the State Home when VA makes payment of a per diem rate to the State 
Home for the patient receiving care at such home, and the patient 
receives VA medical care.
    14. Relevant health care information may be disclosed to (a) A 
Federal agency or non-VA health care provider or institution when VA 
refers a patient for hospital or nursing home care or medical services, 
or authorizes a patient to obtain non-VA medical services and the 
information is needed by the Federal agency or non-VA institution or 
provider to perform the services; or (b) a Federal agency or a non-VA 
hospital (Federal, state and local, public or private) or other medical 
installation having hospital facilities, blood banks, or similar 
institutions, medical schools or clinics, or other groups or 
individuals that have contracted or agreed to provide medical services, 
or share the use of medical resources under the provisions of 38 U.S.C. 
513, 7409, 8111, or 8153, when treatment is rendered by VA under the 
terms of such contract or agreement or the issuance of an 
authorization, and the information is needed for purposes of medical 
treatment and/or follow-up, determining entitlement to a benefit or, 
for VA to effect recovery of the costs of the medical care.
    15. For program review purposes and the seeking of accreditation 
and/or certification, health care information may be disclosed to 
survey teams of TJC, and similar national accrediting agencies or 
boards with whom VA has a contract or agreement to conduct such 
reviews, but only to the extent that the information is necessary and 
relevant to the review.
    16. Information from a named patient's VA medical record which 
relates to the performance of a health care student or provider may be 
disclosed to a medical or nursing school, or other health care related 
training institution, or other facility with which there is an 
affiliation, sharing agreement, contract, or similar arrangement when 
the student or provider is enrolled at or employed by the school or 
training institution, or other facility, and the information is needed 
for personnel management, rating and/or evaluation purposes.
    17. Relevant health care information may be disclosed to 
individuals, organizations, private or public agencies, etc., with whom 
VA has a contract or sharing agreement for the provision of health care 
or administrative services.
    18. Patient identifying information may be disclosed to Federal 
agencies and VA and government-wide third-party insurers responsible 
for payment of the cost of medical care for the identified patients, in 
order for VA to seek recovery of the medical care costs. These records 
may also be disclosed as part of a computer matching program to 
accomplish these purposes.
    19. Relevant health care information may be disclosed to health and 
welfare agencies, housing resources and utility companies, possibly to 
be combined with disclosures to other agencies, in situations where VA 
needs to act quickly in order to provide basic and/or emergency needs 
for the Veteran and Veteran's family where the family resides with the 
Veteran or serves as a caregiver.
    20. The record of an individual who is covered by a system of 
records may be disclosed to a Member of Congress, or a staff person 
acting for the Member, when the Member of staff person requests the 
record on behalf of and at the written request of the individual.
    21. Disclosure may be made to the National Archives and Records 
Administration in records management inspections conducted under 
authority of Title 44 U.S.C.
    22. VA may disclose information from this system of records to the 
Department of Justice (DoJ), either on VA's initiative or in response 
to DoJ's request for the information, after either VA or DoJ determines 
that such information is relevant to DoJ's representation of the United 
States or any of its components in legal proceedings before a court or 
adjudicative body, provided that, in each case, the agency also 
determines prior to disclosure that release of the records to the DoJ 
is a use of the information contained in the records that is compatible 
with the purpose for which VA collected records. VA, on its own 
initiative, may disclose records in this system of records in legal 
proceedings before a court or administrative body after determining 
that the disclosure of the records to the court or administrative body 
is a use of the information contained in the records that is compatible 
with the purpose for which VA collected the records.
    23. Disclosure of relevant information may be made to individuals, 
organizations, private or public agencies, or other entities with whom 
VA has a contract or agreement or where there is a subcontract to 
perform such services as VA may deem practicable for the purposes of 
laws administered by VA, in order for the contractor or subcontractor 
to perform the services of the contract or agreement.
    24. VA may disclose on its own initiative any information in the 
system, except the names and home addresses of Veterans and their 
dependents, that is relevant to a suspected or reasonably imminent 
violation of the law whether civil, criminal, or regulatory in nature 
and whether arising by general or program statute or by regulation, 
rule or order issued pursuant thereto, to a Federal, state, local, 
tribal or foreign agency charged with the responsibility of 
investigating or prosecuting such violation, or charged with enforcing 
or implementing the statute, regulation, rule or order. VA may also 
disclose on its own initiative the names and addresses of Veterans and 
their dependents to a Federal agency charged with the responsibility of 
investigating or prosecuting civil, criminal, or regulatory violations 
of law, or charged with enforcing or implementing the statutes, 
regulation, or order issued pursuant thereto.
    25. Disclosure to other Federal agencies may be made to assist such 
agencies in preventing and detecting possible fraud or abuse by 
individuals in their operations and programs.
    26. VA may, on its own initiative, disclose any information or 
records to appropriate agencies, entities, and persons when (1) VA 
suspects or has confirmed that the integrity or confidentiality of 
information in the system of records has been compromised; (2) the 
Department has determined that as a result of the suspected or 
confirmed compromise,

[[Page 43391]]

there is a risk of embarrassment or harm to the reputations of the 
record subject, harm to economic or property interests, identify theft 
or fraud, or harm to the security, confidentiality, or integrity of 
this system or other systems (entity) that rely upon the potentially 
compromised information; and (3) the disclosure is to agencies, 
entities, or persons whom VA determines as reasonably necessary to 
assist or carry out the Department's efforts to respond to the 
suspected or confirmed compromise and prevent, minimize, or remedy such 
harm. This routine uses permits disclosures by the Department to 
respond to a suspected or confirmed data breach, including the conduct 
of any risk analysis or provision of credit protection services as 
provided in 38 U.S.C. 5724, as the terms are defined in 38 U.S.C. 5727.
    27. For program review purposes and the seeking of accreditation 
and/or certification, disclosure may be made to survey teams of TJC and 
similar national accreditation agencies or boards with whom VA has a 
contract or agreement to conduct such reviews, but only to the extent 
that the information is necessary and relevant to the review.
    28. Disclosure of information may be made to the next-of-kin and/or 
the person(s) with whom the patient has a meaningful relationship to 
the extent necessary and on a need-to-know basis consistent with good 
medical and ethical practices.
    29. Assist in quality improvement efforts with respect to ethics 
consultation practices as part of approved research or ongoing quality 
improvement projects.

POLICIES AND PRACTICES FOR STORING, RETRIEVING, ACCESSING, RETAINING, 
AND DISPOSING OF RECORDS IN THE SYSTEM:
STORAGE:
    Records are maintained on electronic media in ECWeb on a centrally 
located VA-owned server. In most cases, copies of back-up computer 
files are maintained at off-site locations. Subsidiary record 
information is maintained at the various respective ethics consultation 
services within the health care facility and by individuals, 
organizations, and/or agencies with whom VA has a contract or agreement 
to perform such services, as the VA may deem practicable.

RETRIEVABILITY:
    Records are retrieved by consultation number, name of ethics 
consultant, requester, ethics domain or topic, facility, keywords or 
phrases.

SAFEGUARDS:
    1. Access to VA working and storage areas is restricted to VA 
employees on a ``need-to-know'' basis; strict control measures are 
enforced to ensure that disclosure to these individuals is also based 
on this same principle. Generally, VA file areas are locked after 
normal duty hours and the facilities are protected from outside access 
by the Federal Protective Service or other security personnel.
    2. Access to computer rooms at health care facilities is generally 
limited by appropriate locking devices and restricted to authorized VA 
employees and vendor personnel. ADP peripheral devices are placed in 
secure areas (areas that are locked or have limited access) or are 
otherwise protected. Information in ECWeb may be accessed by authorized 
VA employees. Access to file information is controlled at two levels; 
the systems recognize authorized employees by series of individually 
unique passwords/codes as a part of each data message, and the 
employees are limited to only that information in the file, which is 
needed in the performance of their official duties. Information that is 
downloaded from ECWeb and maintained on personal computers is afforded 
similar storage and access protections as the data that is maintained 
in the original files. Access to information stored on automated 
storage media at other VA locations is controlled by individually 
unique passwords/codes.
    3. Access to the Austin VA Data Processing Center is generally 
restricted to Center employees, custodial personnel, Federal Protective 
Service and other security personnel. Access to computer rooms is 
restricted to authorized operational personnel through electronic 
locking devices. All other persons gaining access to computer rooms are 
escorted. Information stored in the computer may be accessed by 
authorized VA employees at remote locations including VA health care 
facilities, Information Systems Centers, VA Central Office, and Veteran 
Integrated Service Networks. Access is controlled by individually 
unique passwords/codes, which must be changed periodically by the 
employee.

RETENTION AND DISPOSAL:
    In accordance with the records disposition authority approved by 
the Archivist of the United States, paper records and information 
stored on electronic storage media are maintained for 75 years after 
the last episode of patient care then destroyed/deleted.

SYSTEM MANAGER(S) AND ADDRESS:
    Official responsible for policies and procedures: Chief Ethics in 
Health Care Officer, National Center for Ethics in Health Care, 
Veterans Health Administration, Department of Veterans Affairs, 810 
Vermont Avenue, NW., Washington, DC 20420. Official maintaining the 
system: Director at the facility where the individuals were associated.

NOTIFICATION PROCEDURE:
    Individuals seeking information regarding access to and contesting 
of ECWeb records may write, call or visit the last VA facility where 
medical care was provided or the National Center for Ethics in Health 
Care.

RECORD ACCESS PROCEDURE:
    Individuals seeking information regarding access to and contesting 
of records in this system may write, call or visit the VA facility 
location where they are or were employed or made contact or the 
National Center for Ethics in Health Care.

CONTESTING RECORD PROCEDURES:
    (See Record Access Procedures above.)

RECORD SOURCE CATEGORIES:
    Information in this system of records is provided by the patient, 
family members or accredited representative, and friends, authorized 
surrogates, health care agents, employees, contractors, medical service 
providers, and various automated systems providing clinical and 
managerial support at VA health care facilities.

[FR Doc. 2011-18315 Filed 7-19-11; 8:45 am]
BILLING CODE P